{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "#!/usr/bin/env python\n",
    "# -*- coding: utf-8 -*-\n",
    "\n",
    "import sys\n",
    "sys.path.append('../')\n",
    "\n",
    "import argparse\n",
    "import numpy as np\n",
    "import random\n",
    "from sklearn.model_selection import GridSearchCV\n",
    "from sklearn import svm\n",
    "from sklearn.utils import shuffle\n",
    "\n",
    "from loglizer.models import InvariantsMiner, PCA, IsolationForest, OneClassSVM, LogClustering, LR, SVM\n",
    "from loglizer import dataloader, preprocessing\n",
    "from loglizer.utils import metrics"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Train normal size: 73136\n",
      "Train abnormal size: 258\n",
      "Total logkey(exclude 0:UNK) 1018\n",
      "Test normal size: 48758\n",
      "Test abnormal size: 388\n",
      "num_unk_event in test data: 0\n",
      "====== Transformed train data summary ======\n",
      "Train data shape: 73394-by-1013\n",
      "\n",
      "====== Transformed test data summary ======\n",
      "Test data shape: 49146-by-1013\n",
      "\n"
     ]
    }
   ],
   "source": [
    "ouput_dir = \"../../../dataset/full_dataset/Thunderbird/\"\n",
    "middle_dir = \"\"\n",
    "log_file = \"Thunderbird.log\"\n",
    "\n",
    "(x_train, y_train), (x_test, y_test) = dataloader.load_data(ouput_dir, middle_dir, log_file, is_mapping=True)\n",
    "feature_extractor = preprocessing.FeatureExtractor()\n",
    "x_train = feature_extractor.fit_transform(x_train)\n",
    "x_test = feature_extractor.transform(x_test)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "==================== Model: PCA ====================\n",
      "theshold 0\n",
      "====== Model summary ======\n",
      "n_components: 5\n",
      "Project matrix shape: 1013-by-1013\n",
      "SPE threshold: 1\n",
      "\n",
      "Train validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 258, FP: 73097, TN: 39, FN: 0\n",
      "Precision: 0.352%, recall: 100.000%, F1-measure: 0.701%\n",
      "\n",
      "Test validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 388, FP: 48729, TN: 29, FN: 0\n",
      "Precision: 0.790%, recall: 100.000%, F1-measure: 1.567%\n",
      "\n",
      "CPU times: user 4min 17s, sys: 14min 18s, total: 18min 36s\n",
      "Wall time: 21 s\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "print(\"=\"*20 + \" Model: PCA \" + \"=\"*20)\n",
    "for th in np.arange(1):\n",
    "    print(\"theshold\", th)\n",
    "    model = PCA(n_components=0.8, threshold=1, c_alpha = 1.9600)\n",
    "    model.fit(x_train)\n",
    "    print('Train validation:')\n",
    "    precision, recall, f1 = model.evaluate(x_train, y_train)\n",
    "    print('Test validation:')\n",
    "    precision, recall, f1 = model.evaluate(x_test, y_test)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "==================== Model: IsolationForest ====================\n",
      "====== Model summary ======\n",
      "Train validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 12, FP: 1278, TN: 71858, FN: 246\n",
      "Precision: 0.930, recall: 4.651, F1-measure: 1.550\n",
      "\n",
      "Test validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 17, FP: 856, TN: 47902, FN: 371\n",
      "Precision: 1.947, recall: 4.381, F1-measure: 2.696\n",
      "\n",
      "CPU times: user 2.35 s, sys: 5.94 s, total: 8.3 s\n",
      "Wall time: 943 ms\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "print(\"=\"*20 + \" Model: IsolationForest \" + \"=\"*20)\n",
    "model = IsolationForest(n_estimators=100, max_samples='auto', contamination='auto', random_state=19)\n",
    "model.fit(x_train)\n",
    "print('Train validation:')\n",
    "precision, recall, f1 = model.evaluate(x_train, y_train)\n",
    "print('Test validation:')\n",
    "precision, recall, f1 = model.evaluate(x_test, y_test)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "==================== Model: one class SVM ====================\n",
      "====== Model summary ======\n",
      "Train validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 41, FP: 73136, TN: 0, FN: 217\n",
      "Precision: 0.056, recall: 15.892, F1-measure: 0.112\n",
      "\n",
      "Test validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 79, FP: 48758, TN: 0, FN: 309\n",
      "Precision: 0.162, recall: 20.361, F1-measure: 0.321\n",
      "\n",
      "CPU times: user 2h 8min 59s, sys: 177 ms, total: 2h 8min 59s\n",
      "Wall time: 2h 9min\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "print(\"=\"*20 + \" Model: one class SVM \" + \"=\"*20)\n",
    "model = OneClassSVM(kernel='rbf')\n",
    "model.fit(x_train, y_train)\n",
    "\n",
    "print('Train validation:')\n",
    "precision, recall, f1 = model.evaluate(x_train, y_train)\n",
    "print('Test validation:')\n",
    "precision, recall, f1 = model.evaluate(x_test, y_test)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "==================== Model: LogClustering ====================\n",
      "====== Model summary ======\n",
      "Starting offline clustering...\n",
      "Processed 1000 instances.\n",
      "Found 79 clusters offline.\n",
      "\n",
      "Starting online clustering...\n",
      "Processed 2000 instances.\n",
      "Processed 4000 instances.\n",
      "Processed 6000 instances.\n",
      "Processed 8000 instances.\n",
      "Processed 10000 instances.\n",
      "Processed 12000 instances.\n",
      "Processed 14000 instances.\n",
      "Processed 16000 instances.\n",
      "Processed 18000 instances.\n",
      "Processed 20000 instances.\n",
      "Processed 22000 instances.\n",
      "Processed 24000 instances.\n",
      "Processed 26000 instances.\n",
      "Processed 28000 instances.\n",
      "Processed 30000 instances.\n",
      "Processed 32000 instances.\n",
      "Processed 34000 instances.\n",
      "Processed 36000 instances.\n",
      "Processed 38000 instances.\n",
      "Processed 40000 instances.\n",
      "Processed 42000 instances.\n",
      "Processed 44000 instances.\n",
      "Processed 46000 instances.\n",
      "Processed 48000 instances.\n",
      "Processed 50000 instances.\n",
      "Processed 52000 instances.\n",
      "Processed 54000 instances.\n",
      "Processed 56000 instances.\n",
      "Processed 58000 instances.\n",
      "Processed 60000 instances.\n",
      "Processed 62000 instances.\n",
      "Processed 64000 instances.\n",
      "Processed 66000 instances.\n",
      "Processed 68000 instances.\n",
      "Processed 70000 instances.\n",
      "Processed 72000 instances.\n",
      "Processed 73136 instances.\n",
      "Found 220 clusters online.\n",
      "\n",
      "Train validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 1, FP: 6, TN: 73130, FN: 257\n",
      "Precision: 14.286, recall: 0.388, F1-measure: 0.755\n",
      "\n",
      "Test validation:\n",
      "====== Evaluation summary ======\n",
      "Confusion Matrix: TP: 2, FP: 28, TN: 48730, FN: 386\n",
      "Precision: 6.667, recall: 0.515, F1-measure: 0.957\n",
      "\n",
      "CPU times: user 6min 3s, sys: 0 ns, total: 6min 3s\n",
      "Wall time: 6min 4s\n"
     ]
    }
   ],
   "source": [
    "%%time\n",
    "print(\"=\"*20 + \" Model: LogClustering \" + \"=\"*20)\n",
    "max_dist = 0.3  # the threshold to stop the clustering process\n",
    "anomaly_threshold = 0.3  # the threshold for anomaly detection\n",
    "model = LogClustering(max_dist=max_dist, anomaly_threshold=anomaly_threshold)\n",
    "model.fit(x_train[y_train == 0, :])  # Use only normal samples for training\n",
    "print('Train validation:')\n",
    "precision, recall, f1 = model.evaluate(x_train, y_train)\n",
    "print('Test validation:')\n",
    "precision, recall, f1 = model.evaluate(x_test, y_test)\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "experiment",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}
